We are committed to complying with the UK General Data Protection Regulation and the Data Protection Act 2018. This page explains how we meet our obligations and respect your rights regarding personal data protection.
For the purposes of data protection legislation, we act as the data controller for personal information collected through our website and business operations. This means we determine how and why your personal data is processed.
We process personal data only when we have a lawful basis under GDPR Article 6. The specific basis depends on the type of processing:
When you request services from us, processing your personal information is necessary to fulfill contractual obligations, including arranging surveys, providing quotes, scheduling installations, and completing agreed work.
We process certain data based on legitimate interests in operating our business effectively, improving service quality, maintaining business records, and responding to enquiries. We balance these interests against your rights and freedoms.
Some processing is necessary to comply with legal obligations, such as maintaining financial records, meeting health and safety requirements, and responding to lawful requests from authorities.
Where processing relies on consent, we ensure consent is freely given, specific, informed, and unambiguous. You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.
You have the right to obtain confirmation about whether we process your personal data and, if so, to access that data along with information about how it's being used. We will provide this information within one month of your request.
If personal information we hold about you is inaccurate or incomplete, you have the right to have it corrected or completed. We will make amendments within one month and notify any third parties with whom we've shared the data.
You may request deletion of your personal data in certain circumstances, including when the data is no longer necessary for its original purpose, when you withdraw consent, when you object to processing, or when processing is unlawful. This right is not absolute and may be limited by legal record-keeping requirements.
You can request limitation of how we process your data when you contest data accuracy, when processing is unlawful but you prefer restriction over erasure, when we no longer need the data but you require it for legal claims, or when you've objected to processing pending verification of our legitimate grounds.
Where processing is based on consent or contractual performance and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing relates to legal claims.
We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.
To exercise any of your GDPR rights, contact us using the details provided on our contact page. We will respond to requests within one month, though this may be extended by two months for complex requests. We will explain any extension and the reasons for delay.
We do not charge fees for exercising your rights unless requests are manifestly unfounded or excessive, particularly if repetitive. In such cases, we may charge a reasonable fee or refuse to act on the request.
We implement appropriate technical measures including secure data transmission, access controls, regular security assessments, and protection against unauthorized access or disclosure.
Our organizational measures include staff training on data protection, clear data handling procedures, limitation of data access to authorized personnel only, and regular review of our data protection practices.
We collect and process only the personal data necessary for specified purposes. We do not collect excessive information or retain data longer than necessary.
We take reasonable steps to ensure personal data is accurate and kept up to date. You can help by informing us of any changes to your information.
We retain personal data only as long as necessary for the purposes for which it was collected. Retention periods vary based on data type and purpose:
In the event of a personal data breach likely to result in high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Information Commissioner's Office within seventy-two hours of becoming aware of the breach, unless the breach is unlikely to result in risk to individuals' rights and freedoms.
We do not routinely transfer personal data outside the United Kingdom. If international transfers become necessary, we will implement appropriate safeguards as required by data protection legislation, such as adequacy decisions or standard contractual clauses.
Our services are not directed at children. We do not knowingly process personal data of individuals under sixteen years of age without parental consent.
If you believe we have not complied with GDPR requirements or have concerns about our data protection practices, please contact us first so we can address the issue. You also have the right to lodge a complaint with the Information Commissioner's Office at any time.
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
We review our GDPR compliance measures regularly and update this information as necessary to reflect changes in our practices or legal requirements.